Verifying the Changes are Planned and Controlled – ISMS V2022 Series

Verify that changes are planned and controlled, and that unintended changes are reviewed to mitigate any adverse results, you can implement a robust Change Management process. This process should include specific steps, roles, responsibilities, and tools to ensure that all changes are handled properly. Here’s a detailed approach to verifying effective change management:

1. Change Management Policy

A. Develop and Implement a Change Management Policy

Actions:

·        Create a documented change management policy that outlines the procedures for planning, approving, implementing, and reviewing changes.

·        Ensure the policy includes guidelines for both planned and unintended changes.

Tools:

·        Change management policy document.

2. Change Request and Approval Process

A. Change Request Submission

Actions:

·        Require all changes to be formally requested using a Change Request Form.

·        Include details such as the reason for the change, the impact, and the proposed implementation plan.

Tools:

·        Change Request Form template.

·        Change request tracking system.

B. Change Approval

Actions:

·        Establish a Change Advisory Board (CAB) to review and approve change requests.

·        Ensure that the CAB evaluates the potential impact, risks, and benefits of each change.

Tools:

·        CAB meeting agendas and minutes.

·        Change request approval workflow.

3. Planning and Implementation

A. Detailed Change Planning

Actions:

·        Develop detailed change implementation plans that include timelines, resources, and rollback procedures.

·        Ensure plans are reviewed and approved before implementation.

Tools:

·        Change implementation plan templates.

·        Project management software.

B. Controlled Implementation

Actions:

·        Implement changes according to the approved plans.

·        Monitor the implementation to ensure it proceeds as planned and to identify any issues.

Tools:

·        Implementation checklists.

·        Monitoring and logging tools.

4. Review and Validation

A. Post-Implementation Review

Actions:

·        Conduct a post-implementation review to verify that the change achieved its intended outcomes.

·        Review logs and monitoring data to ensure no unintended impacts occur.

Tools:

·        Post-implementation review reports.

·        Performance monitoring tools.

5. Unintended Changes

A. Identification and Reporting

Actions:

·        Implement procedures for identifying and reporting unintended changes promptly.

·        Use automated monitoring tools to detect unauthorized changes.

Tools:

·        Incident reporting systems.

·        Automated monitoring tools.

B. Review and Mitigation

Actions:

·        Investigate unintended changes to determine their cause and impact.

·        Develop and implement corrective actions to mitigate any adverse effects.

Tools:

·        Incident investigation reports.

·        Corrective action plans.

6. Continuous Monitoring and Improvement

A. Regular Audits

Actions:

·        Conduct regular audits of the change management process to ensure compliance and identify areas for improvement.

·        Include both planned and unintended changes in the audit scope.

Tools:

·        Audit checklists.

·        Audit reports.

B. Feedback and Updates

Actions:

·        Collect feedback from stakeholders on the change management process.

·        Update the change management policy and procedures based on audit findings and feedback.

Tools:

·        Feedback forms.

·        Change management policy updates.

Example Change Management Process Flow

Change Request Submission

·        Employee submits a change request form.

·        Request is logged in the change request tracking system.

Change Review and Approval

·        CAB reviews the change request.

·        CAB evaluates the impact, risks, and benefits.

·        CAB approves or rejects the change request.

Change Planning

·        Detailed change implementation plan is developed.

·        Plan includes timelines, resources, and rollback procedures.

·        Plan is reviewed and approved.

Controlled Implementation

·        Change is implemented according to the approved plan.

·        Implementation is monitored and logged.

Post-Implementation Review

·        Post-implementation review is conducted.

·        Logs and monitoring data are reviewed.

·        Review verifies the change achieved its intended outcomes.

Unintended Change Handling

·        Unintended changes are identified and reported.

·        Investigation determines cause and impact.

·        Corrective actions are implemented.

Continuous Monitoring and Improvement

·        Regular audits are conducted.

·        Feedback is collected and used to update policies and procedures.

Tools and Documentation

Change Management Policy Document

Change Request Form Template

Change Request Tracking System

CAB Meeting Agendas and Minutes

Change Implementation Plan Templates

Project Management Software

Implementation Checklists

Monitoring and Logging Tools

Post-Implementation Review Reports

Incident Reporting Systems

Automated Monitoring Tools

Incident Investigation Reports

Corrective Action Plans

Audit Checklists and Reports

Feedback Forms

By following these steps and using the outlined tools, an organization can verify that changes are planned and controlled effectively, and that unintended changes are promptly reviewed and mitigated to avoid adverse results.